Fix “fatal: remote error: CAPTCHA required” in Sourcetree and Bitbucket

If Git in Sourcetree stops with fatal: remote error: CAPTCHA required, Bitbucket is rejecting authentication after repeated failed sign-in attempts. The cause is often an old password or token saved by a Git client, another account selected in Sourcetree, or an automated job retrying invalid credentials. A changed Windows or macOS password can contribute when saved credentials are stale, but it is only one possible cause.

The browser can display and solve a CAPTCHA challenge; a Git client cannot. First restore account access in a browser, then replace stale credentials in Sourcetree and Git.

What the Bitbucket CAPTCHA error means

The message commonly appears when Bitbucket has temporarily blocked Git access after too many incorrect authentication attempts. The failure happens during authentication, before Git can fetch or push repository data, so changing your code or deleting the repository is not the fix.

git fetch origin
fatal: remote error: CAPTCHA required

The exact behavior can differ between Bitbucket Cloud and a self-hosted Bitbucket Data Center server. If you use a company server, your administrator may need to check the account lock or authentication logs.

How to fix “CAPTCHA required” in Sourcetree

1. Stop repeated Git attempts. Pause fetches, pulls, pushes, IDE integrations, scripts, and build jobs that may still be retrying an old credential. Repeated failures can keep triggering the block.
2. Sign in to the correct Bitbucket account in your browser. Open Bitbucket and complete any CAPTCHA or verification challenge shown there. Confirm you can access the workspace and repository. If the account remains locked, contact your Bitbucket administrator or Atlassian support.
3. Remove stale credentials. In Sourcetree for Windows, open Tools > Options > Authentication and remove the outdated Bitbucket account or credential. In Sourcetree for macOS, open SourceTree > Settings > Accounts and edit or remove the old account. Also check your operating system’s credential store: Windows Credential Manager, macOS Keychain Access, or the credential helper configured for Git.
4. Refresh Bitbucket Cloud authentication. Bitbucket Cloud no longer accepts account passwords or app passwords for Git over HTTPS. Create a Bitbucket API token with the repository permissions you need, then use it in Sourcetree. Current Sourcetree versions that support API tokens are required (Windows 3.4.24 or later; macOS 4.2.14 or later).
5. Reconnect and test once. In Sourcetree, add or edit the Bitbucket account, select API Token authentication, and use your Atlassian account email with the token when prompted. Then try Fetch; if that succeeds, test Pull or Push as needed.

For a pull, the token needs repository read permission. For a push, it needs both repository read and write permissions. Grant only the scopes required for your workflow. Follow Atlassian’s current guides for adding an API token to Sourcetree and using API tokens with Git.

Using Git from the command line

Check whether your remote uses HTTPS or SSH:

git remote -v

For Bitbucket Cloud over HTTPS, authenticate with your exact Bitbucket username and an API token when Git prompts for a username and password. The token acts as the password; your Atlassian account password does not. Do not put a personal token directly in the remote URL because URLs may be saved in shell history, logs, or Git configuration.

SSH keys are another way to authenticate Git operations without an HTTPS password prompt. Set up and register an SSH key with Bitbucket, then use the SSH remote URL. Switching to SSH does not itself unlock an account that is currently blocked by repeated failed authentication.

If the CAPTCHA error keeps coming back

• Look for another computer, IDE, credential helper, scheduled script, or build agent using the old password or expired token.
• Update the saved credential in every Git client that accesses the same Bitbucket account.
• Check that Sourcetree is connected to the intended Bitbucket account and workspace.
• For self-hosted Bitbucket Data Center, ask the administrator to review failed authentication attempts and account lock status. CAPTCHA protects the account; disabling it is not a recommended fix.

Prevent the Bitbucket authentication error

• Use a current Sourcetree release that supports Bitbucket API tokens.
• Replace saved credentials whenever a token expires or is revoked.
• Use the minimum API token scopes needed for read, pull, and push operations.
• Remove outdated credentials from the system credential store and other Git clients.
• Avoid automatic retry loops that repeatedly send invalid credentials.
• Keep tokens out of screenshots, source files, remote URLs, and shared logs.

Frequently asked questions

Is this a Git repository or code problem?

Usually not. The error indicates an authentication challenge or account lock before Git can access the remote repository. Fix the Bitbucket sign-in and saved credentials first.

Should I delete SourceTree’s Passwd file?

Start by removing or updating credentials through Sourcetree and your operating system’s credential manager. The location and format of SourceTree credential files vary by version, so deleting a file such as Passwd is an older workaround and should only be considered if the supported account and credential controls do not clear the stale entry. Back up any file before changing it.

Can I use my Bitbucket account password for Git?

For Bitbucket Cloud over HTTPS, use an API token instead of your account password or an app password. For a self-hosted Bitbucket server, follow your organization’s authentication instructions.

Summary

To resolve fatal: remote error: CAPTCHA required, stop clients from retrying bad credentials, complete any challenge in the browser, clear stale Sourcetree and Git credentials, and reconnect with a current Bitbucket Cloud API token or your organization’s supported authentication method. These steps address the authentication issue and help prevent it from disrupting future fetch, pull, and push operations.